General
- Target 2026-07-17_261613a4b483f965c32f9eb2fe61745d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 12.9MB
- Sample260717-stxtssew3l
- SHA256 df142793ecb1e9c6691761a0e4c34aea8e9de0a40e0a9ac786734e79235834ed
- MD5 261613a4b483f965c32f9eb2fe61745d
- SHA1 47aa5e44c25dbfe38a77438471273a35e38cbe27
- SHA512 d9a21d82a782d8d2809ddd9c60796bd2dbd092a90d9a0e1a87c9e0d110f1eff48cbfa955959c91bea3a0a1ea0bf8c9dca8c04541abf378f9d85f1ebdc35f5d90
- SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0NWyZ/K0ttYVAAT3/h1+:mqnqxyZ/K0ttYZT
- TLSH T15FD66B13F1A441E9E06AD174CE569232EB327C494BF1A5EF3240B6D92E37AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_261613a4b483f965c32f9eb2fe61745d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_261613a4b483f965c32f9eb2fe61745d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_261613a4b483f965c32f9eb2fe61745d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 12.9MB
- SHA256 df142793ecb1e9c6691761a0e4c34aea8e9de0a40e0a9ac786734e79235834ed
- MD5 261613a4b483f965c32f9eb2fe61745d
- SHA1 47aa5e44c25dbfe38a77438471273a35e38cbe27
- SHA512 d9a21d82a782d8d2809ddd9c60796bd2dbd092a90d9a0e1a87c9e0d110f1eff48cbfa955959c91bea3a0a1ea0bf8c9dca8c04541abf378f9d85f1ebdc35f5d90
- SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0NWyZ/K0ttYVAAT3/h1+:mqnqxyZ/K0ttYZT
- TLSH T15FD66B13F1A441E9E06AD174CE569232EB327C494BF1A5EF3240B6D92E37AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry